Qode Tours
Monthly
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.